CVE-2026-7678 is a medium severity SQL injection vulnerability in YunaiV yudao-cloud version 2026.01. It affects the getDataBySQL function in the GoViewDataServiceImpl.java file, allowing remote attackers to manipulate SQL queries. The vulnerability is publicly known and exploitable, but no vendor response or patch has been provided. The CVSS 4.0 base score is 5.3, indicating a moderate risk level.
A flaw has been found in CodeAstro Online Classroom 1.0. This affects an unknown part of the file /addnewfaculty. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
A vulnerability was identified in code-projects Online Lot Reservation System 1.0. Affected is an unknown function of the file /edithousepic.php. Such manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.
CVE-2026-6149 is a medium severity SQL injection vulnerability in version 1.0 of the code-projects Vehicle Showroom Management System. The flaw exists in the /util/BookVehicleFunction.php file, where manipulation of the BRANCH_ID argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. An exploit has been published, but there are no known exploits in the wild at this time. No official patch or remediation guidance is currently available from the vendor.
A vulnerability was detected in code-projects Vehicle Showroom Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /util/MonthTotalReportUpdateFunction.php. Performing a manipulation of the argument BRANCH_ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload functionality on the /my-profile.php page.
A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This vulnerability affects unknown code of the file /topic-details.php. The manipulation of the argument post_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5606 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The flaw exists in the /order-details.php file where the orderid parameter is improperly handled, allowing remote attackers to inject SQL code. This vulnerability could potentially allow unauthorized access or manipulation of the backend database. No official patch or remediation guidance is currently available from the vendor. Exploits in the wild are not known at this time.
CVE-2026-5579 is a medium severity SQL injection vulnerability in CodeAstro Online Classroom version 1.0. It affects the parameter 'fname' in the file /OnlineClassroom/updatedetailsfromfaculty.php, allowing remote attackers to manipulate SQL queries. The vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available. Exploitation requires low privileges and no user interaction. The impact includes potential unauthorized database access or modification. No known exploits in the wild have been reported yet.
CVE-2026-5578 is a medium severity SQL injection vulnerability in CodeAstro Online Classroom version 1.0. It affects the parameter 'deleteid' in the /OnlineClassroom/addassessment.php file, allowing remote attackers to manipulate this argument to perform SQL injection. The vulnerability has been publicly disclosed, but no official patch or remediation guidance has been provided by the vendor. Exploitation requires low privileges and no user interaction, with limited scope and impact as per the CVSS vector.
A security vulnerability has been detected in code-projects Simple Laundry System 1.0. Affected by this issue is some unknown functionality of the file /delmemberinfo.php of the component Parameter Handler. Such manipulation of the argument userid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
A flaw has been found in Campcodes Complete Online Learning Management System 1.0. This impacts the function add_lesson of the file /application/models/Crud_model.php. This manipulation causes unrestricted upload. It is possible to initiate the attack remotely. The exploit has been published and may be used.
A security vulnerability has been detected in code-projects Simple Gym Management System 1.0. This vulnerability affects unknown code of the component Payment Handler. The manipulation of the argument Payment_id/Amount/customer_id/payment_type/customer_name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2026-5197 is a medium severity SQL injection vulnerability in code-projects Student Membership System version 1.0. It occurs in an unknown function within the /delete_user.php file, where manipulation of the ID parameter allows remote attackers to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a moderate risk. Exploit code has been publicly disclosed, but there are no known exploits in the wild at this time. No official patch or remediation guidance is currently available from the vendor.
A vulnerability has been found in code-projects Student Membership System 1.0. Impacted is an unknown function of the file /delete_member.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
SourceCodester Simple Doctors Appointment System version 1.0 contains a SQL injection vulnerability in the /admin/ajax.php? action=login2 endpoint. The flaw arises from improper handling of the 'email' parameter, allowing remote attackers to manipulate SQL queries. This vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance is currently provided, and no known exploits have been reported in the wild.
CVE-2026-4849 is a cross-site scripting (XSS) vulnerability in code-projects Simple Laundry System version 1.0. The issue exists in the /modify.php file within the Parameter Handler component, where the firstName argument can be manipulated to execute malicious scripts. The vulnerability can be exploited remotely and requires user interaction. No official patch or remediation guidance is currently provided by the vendor. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
A vulnerability was determined in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_s3.php. Executing a manipulation of the argument sname can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was detected in PHPEMS 11.0. The affected element is an unknown function of the file /index.php?ask=app-ask. Performing a manipulation of the argument askcontent results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.
A flaw has been found in YiFang CMS 2.0.5. This affects the function update of the file app/db/admin/D_singlePageGroup.php. Executing a manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.